Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-44593esm.sh: Legacy Route Path Traversal Can Lead to RCEGo · github.com/esm-dev/esm.sh · fixed in 0.0.0-20260508100112-1960055e1d53
- CVE-2026-9804Kubevirt: kubevirt: vmexport directory symlink escape enables exporter pod file readGo · kubevirt.io/kubevirt
- CVE-2026-9739Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790).Go · github.com/googleapis/mcp-toolbox · fixed in 1.2.0
- CVE-2026-45152uniget: Command Injection in tool.Check Leading to Arbitrary Code ExecutionGo · gitlab.com/uniget-org/cli · fixed in 0.27.1
- CVE-2026-44247Volcano: Webhook server vulnerable to OOM due to unbounded HTTP request body sizeGo · volcano.sh/volcano · fixed in 1.12.4, 1.13.3, 1.14.2
- CVE-2026-45046Gryph Agents Payload Filter Fails to Strip Tool Payload for Sensitive ContentGo · github.com/safedep/gryph · fixed in 0.7.0
- CVE-2026-45088Dalfox: Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file` in Dalfox Server ModeGo · github.com/hahwul/dalfox, github.com/hahwul/dalfox/v2 · fixed in 2.13.0
- CVE-2026-45087Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server ModeGo · github.com/hahwul/dalfox, github.com/hahwul/dalfox/v2 · fixed in 2.13.0
- CVE-2026-45089Dalfox: Unauthenticated Arbitrary File Create/Append via `output` Option in Dalfox Server ModeGo · github.com/hahwul/dalfox, github.com/hahwul/dalfox/v2 · fixed in 2.13.0
- CVE-2026-45090Dalfox: Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode)Go · github.com/hahwul/dalfox, github.com/hahwul/dalfox/v2 · fixed in 2.13.0
- CVE-2026-45047bird-lg-go: Fatal Out-of-Memory (OOM) Denial of Service via Unbounded JSON DecodingGo · github.com/xddxdd/bird-lg-go · fixed in 0.0.0-20260507060110-0ff87024cb9e
- CVE-2026-42328go-ipld-prime: DAG-CBOR and DAG-JSON decoders unbounded recursion depthGo · github.com/ipld/go-ipld-prime · fixed in 0.23.0
- CVE-2026-42081free5GC: UE Security Capability bypass on NGAP PathSwitchRequestGo · github.com/free5gc/amf
- CVE-2026-42082free5GC: Missing Concurrent NAS SMC Validation During NGAP HandoverGo · github.com/free5gc/amf
- CVE-2026-42083free5GC: PCF Npcf_SMPolicyControl missing authentication middleware allows unauthenticated access to SM policy handlers and disclosure of subscriber SUPIGo · github.com/free5gc/pcf · fixed in 1.4.3
- CVE-2026-42459free5GC: Improper Input Validation and Generation of Error Message Containing Sensitive Information in github.com/free5gc/udmGo · github.com/free5gc/udm
- CVE-2026-44315free5GC: NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactionsGo · github.com/free5gc/nef
- CVE-2026-44316free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereferenceGo · github.com/free5gc/pcf · fixed in 1.4.2
- CVE-2026-44317free5GC: PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereferenceGo · github.com/free5gc/pcf · fixed in 1.4.3
- CVE-2026-44319free5GC: NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri)Go · github.com/free5gc/nef · fixed in 1.2.3
- CVE-2026-44320free5GC: NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing pathGo · github.com/free5gc/nef
- CVE-2026-44321free5GC: SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf)Go · github.com/free5gc/smf
- CVE-2026-44322free5GC: NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereferenceGo · github.com/free5gc/nef · fixed in 1.2.3
- CVE-2026-44323free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference)Go · github.com/free5gc/udr · fixed in 1.4.3
- CVE-2026-44324free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request)Go · github.com/free5gc/udr · fixed in 1.4.3
- CVE-2026-44325free5GC: NRF POST /oauth2/token structured-form parser type-confusion panic family (Reflect.Set on incompatible types)Go · github.com/free5gc/nrf · fixed in 1.4.3
- CVE-2026-44326free5GC: NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptionsGo · github.com/free5gc/nef
- CVE-2026-44327free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handlerGo · github.com/free5gc/nef
- CVE-2026-44328free5GC: SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF dereference; unauthenticated, state-mutatingGo · github.com/free5gc/smf · fixed in 1.4.3
- CVE-2026-44329free5GC: SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlersGo · github.com/free5gc/smf · fixed in 1.4.3